Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Dell Cloud Disaster Recovery 20.2 allows remote request abuse

CVE-2026-71172 · published 2 months ago
Summary

Versions of Dell Cloud Disaster Recovery up to 20.2 let a user with limited rights who can reach the system trick it into making its own network requests. This could let an attacker reach internal services or discover internal information. Apply the latest update from Dell to close the gap and restrict access to trusted users.

What to do
  • Update dell cloud disaster recovery to version CDR 20.3 or later.
  • Update dell cloud_disaster_recovery to version 20.3 or later.
Affected software
VendorProductAffected versions
dell cloud disaster recovery < CDR 20.3
dell cloud_disaster_recovery < 20.3
cpe:2.3:a:dell:cloud_disaster_recovery:*:*:*:*:*:*:*:*
Original advisory text
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulner...
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published26 Aug 2026
Updated4 Nov 2026
First seen26 Aug 2026
Sources
CVE-2026-71172 · NVD
CVE-2026-71172 · MITRE
Track software like this
Free during beta